(L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds
CIS.M365.5.2.3.9MediumEntra IDPassword protectionPreview 3.0
Part of CIS · Entra ID · Password protection · All checks
Invoke-Maester -TestId CIS.M365.5.2.3.9Overview
Section titled “Overview”The smart lockout duration is not shorter than the recommended minimum.
When smart lockout triggers, the account is locked for the configured duration. A very short duration lets an attacker resume guessing almost immediately, which cancels the benefit of the threshold.
When the duration is not stored in the tenant’s password rule settings, Microsoft Entra applies its default of 60 seconds, which meets the recommendation. Lockout threshold is checked by a separate test.
Remediation action
Section titled “Remediation action”- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Password protection.
- Set Lockout duration in seconds to 60 or more.
- Select Save.
Related links
Section titled “Related links”- Microsoft Entra admin center - Password protection
- Protect user accounts from attacks with Microsoft Entra smart lockout
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.9
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.9, nist-800-53-r5:AC-7 |
| PowerShell test | Test-MtCisSmartLockoutDuration |
| Services | Graph |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.5.2.3.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.9.md